[Feature] Resolve TokenAudience from default_oidc_audience in host metadata (#1597)

## Summary

Adds `DefaultOIDCAudience` to the `HostMetadata` struct so the SDK can
parse the new `default_oidc_audience` field from the
`/.well-known/databricks-config` discovery endpoint and use it to
populate `TokenAudience` during config resolution.

  ## Why

Today, `TokenAudience` for account hosts is inferred by a heuristic: if
the host metadata has no `workspace_id` and has an `account_id`, the SDK
sets
`TokenAudience` to the account ID. For workspace hosts, no audience is
set at all — credential strategies must know the right value
independently.

The server-side `/.well-known/databricks-config` endpoint is being
updated to return a `default_oidc_audience` field that provides the
correct OIDC audience
  directly:
  - **Workspace hosts**: `https://<workspace_host>/oidc/v1/token`
  - **Account/unified hosts**: the resolved account ID

Using this authoritative value from the server removes the need for
host-pattern guessing and ensures correctness for vanity domains,
unified hosts, and future
  host types.

  ## What changed

  ### Interface changes

- **`HostMetadata.DefaultOIDCAudience string`** — New field
(`json:"default_oidc_audience"`) that holds the default OIDC audience
from the discovery endpoint.

  ### Behavioral changes

- During `resolveHostMetadata`, if `TokenAudience` is empty and
`meta.DefaultOIDCAudience` is non-empty, `TokenAudience` is set from it.
This takes priority over
  the existing account-ID-based fallback.
  - User-set `TokenAudience` is never overwritten.
- Servers that do not return the field fall back to the existing
behavior (no breaking change).

  ### Internal changes

  None.

  ## How is this tested?

  Unit tests covering all resolution paths:
- `TestGetHostMetadata_WithDefaultOIDCAudience` — JSON parsing for
workspace audience, account audience, and missing field
- `TestApplyHostMetadata_SetsTokenAudienceFromDefaultOIDCAudience` —
audience resolved from well-known for workspace host
-
`TestApplyHostMetadata_DefaultOIDCAudienceTakesPriorityOverAccountIDFallback`
— new field wins over account-ID fallback
- `TestApplyHostMetadata_DefaultOIDCAudienceDoesNotOverrideExisting` —
user-set `TokenAudience` preserved
- `TestApplyHostMetadata_FallsBackToAccountIDWhenNoDefaultOIDCAudience`
— backward compat with old servers

Author: tanmay-db

NEXT_CHANGELOG.md

@@ -10,6 +10,7 @@
 
 * Added `HostMetadataResolver` hook to allow callers to customize host metadata resolution, e.g. with caching ([#1572](https://github.com/databricks/databricks-sdk-go/pull/1572)).
 * Added `NewLimitIterator` to `listing` package for lazy iteration with a cap on output items ([#1555](https://github.com/databricks/databricks-sdk-go/pull/1555)).
+* Resolve `TokenAudience` from `default_oidc_audience` in host metadata discovery endpoint.
 
 ### Bug Fixes
 

config/config.go

@@ -702,6 +702,10 @@ func (c *Config) resolveHostMetadata(ctx context.Context) {
 		c.Cloud = c.Environment().Cloud
 		logger.Debugf(ctx, "Resolved cloud from hostname: %q", c.Cloud)
 	}
+	if c.TokenAudience == "" && meta.DefaultOIDCAudience != "" {
+		logger.Debugf(ctx, "Resolved token_audience from host metadata default_oidc_audience: %q", meta.DefaultOIDCAudience)
+		c.TokenAudience = meta.DefaultOIDCAudience
+	}
 	if c.TokenAudience == "" && meta.WorkspaceID == "" && c.AccountID != "" {
 		logger.Debugf(ctx, "Setting token_audience to account_id for account host: %q", c.AccountID)
 		c.TokenAudience = c.AccountID

config/config_test.go

@@ -745,6 +745,89 @@ func TestApplyHostMetadata_DoesNotOverrideExistingTokenAudience(t *testing.T) {
 	assert.Equal(t, "custom-audience", cfg.TokenAudience)
 }
 
+func TestApplyHostMetadata_SetsTokenAudienceFromDefaultOIDCAudience(t *testing.T) {
+	noopLoader := mockLoader(func(cfg *Config) error { return nil })
+	cfg := &Config{
+		Host:    testHMHost,
+		Loaders: []Loader{noopLoader},
+		HTTPTransport: fixtures.SliceTransport{
+			{
+				Method:       "GET",
+				Resource:     "/.well-known/databricks-config",
+				ReuseRequest: true,
+				Status:       200,
+				Response:     `{"oidc_endpoint": "` + testHMHost + `/oidc", "account_id": "` + testHMAccountID + `", "workspace_id": "` + testHMWorkspaceID + `", "cloud": "AWS", "default_oidc_audience": "` + testHMHost + `/oidc/v1/token"}`,
+			},
+		},
+	}
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+	assert.Equal(t, testHMHost+"/oidc/v1/token", cfg.TokenAudience)
+}
+
+func TestApplyHostMetadata_DefaultOIDCAudienceTakesPriorityOverAccountIDFallback(t *testing.T) {
+	noopLoader := mockLoader(func(cfg *Config) error { return nil })
+	cfg := &Config{
+		Host:    testHMHost,
+		Loaders: []Loader{noopLoader},
+		HTTPTransport: fixtures.SliceTransport{
+			{
+				Method:       "GET",
+				Resource:     "/.well-known/databricks-config",
+				ReuseRequest: true,
+				Status:       200,
+				Response:     `{"oidc_endpoint": "` + testHMHost + `/oidc", "account_id": "` + testHMAccountID + `", "cloud": "AWS", "default_oidc_audience": "custom-audience-from-server"}`,
+			},
+		},
+	}
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+	// default_oidc_audience should take priority over the account_id fallback
+	assert.Equal(t, "custom-audience-from-server", cfg.TokenAudience)
+}
+
+func TestApplyHostMetadata_DefaultOIDCAudienceDoesNotOverrideExisting(t *testing.T) {
+	noopLoader := mockLoader(func(cfg *Config) error { return nil })
+	cfg := &Config{
+		Host:          testHMHost,
+		TokenAudience: "user-set-audience",
+		Loaders:       []Loader{noopLoader},
+		HTTPTransport: fixtures.SliceTransport{
+			{
+				Method:       "GET",
+				Resource:     "/.well-known/databricks-config",
+				ReuseRequest: true,
+				Status:       200,
+				Response:     `{"oidc_endpoint": "` + testHMHost + `/oidc", "account_id": "` + testHMAccountID + `", "cloud": "AWS", "default_oidc_audience": "` + testHMHost + `/oidc/v1/token"}`,
+			},
+		},
+	}
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+	assert.Equal(t, "user-set-audience", cfg.TokenAudience)
+}
+
+func TestApplyHostMetadata_FallsBackToAccountIDWhenNoDefaultOIDCAudience(t *testing.T) {
+	noopLoader := mockLoader(func(cfg *Config) error { return nil })
+	cfg := &Config{
+		Host:    testHMHost,
+		Loaders: []Loader{noopLoader},
+		HTTPTransport: fixtures.SliceTransport{
+			{
+				Method:       "GET",
+				Resource:     "/.well-known/databricks-config",
+				ReuseRequest: true,
+				Status:       200,
+				Response:     `{"oidc_endpoint": "` + testHMHost + `/oidc", "account_id": "` + testHMAccountID + `", "cloud": "AWS"}`,
+			},
+		},
+	}
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+	// No default_oidc_audience and no workspace_id → falls back to account_id
+	assert.Equal(t, testHMAccountID, cfg.TokenAudience)
+}
+
 func TestEnsureResolved_UsesCustomHostMetadataResolver(t *testing.T) {
 	noopLoader := mockLoader(func(cfg *Config) error { return nil })
 	cfg := &Config{

config/host_metadata.go

@@ -22,6 +22,11 @@ type HostMetadata struct {
 
 	// Cloud is the cloud provider for this Databricks deployment (AWS, Azure, or GCP).
 	Cloud environment.Cloud `json:"cloud"`
+
+	// DefaultOIDCAudience is the default OIDC audience for token requests.
+	// For workspace hosts: "https://<workspace_host>/oidc/v1/token"
+	// For account/unified hosts: the resolved account ID.
+	DefaultOIDCAudience string `json:"default_oidc_audience"`
 }
 
 // HostMetadataResolver, when set on [Config], overrides the default HTTP fetch

config/host_metadata_test.go

@@ -86,6 +86,54 @@ func TestGetHostMetadata_HTTPError(t *testing.T) {
 	}
 }
 
+func TestGetHostMetadata_WithDefaultOIDCAudience(t *testing.T) {
+	tests := []struct {
+		name         string
+		audience     string
+		wantAudience string
+	}{
+		{
+			name:         "workspace audience",
+			audience:     testHMHost + "/oidc/v1/token",
+			wantAudience: testHMHost + "/oidc/v1/token",
+		},
+		{
+			name:         "account audience",
+			audience:     testHMAccountID,
+			wantAudience: testHMAccountID,
+		},
+		{
+			name:         "missing field",
+			audience:     "",
+			wantAudience: "",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			response := map[string]string{
+				"oidc_endpoint": testHMHost + "/oidc",
+				"account_id":    testHMAccountID,
+			}
+			if tc.audience != "" {
+				response["default_oidc_audience"] = tc.audience
+			}
+			client := newTestAPIClient(fixtures.MappingTransport{
+				"GET /.well-known/databricks-config": {
+					Status:   200,
+					Response: response,
+				},
+			})
+			meta, err := getHostMetadata(context.Background(), testHMHost, client)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if meta.DefaultOIDCAudience != tc.wantAudience {
+				t.Errorf("DefaultOIDCAudience mismatch: got %q, want %q", meta.DefaultOIDCAudience, tc.wantAudience)
+			}
+		})
+	}
+}
+
 func TestGetHostMetadata_WithCloudField(t *testing.T) {
 	tests := []struct {
 		name      string